Data Processing Agreement

Parties

This Data Processing Agreement ("DPA") is entered into between:

• Bacimo ("Processor", "BaciScout"), with registered address at Karpatské námestie 10A, Bratislava – Rača, 831 06, Slovak Republic, acting as the provider of the BaciScout SaaS platform (the "Service").
• The customer entity ("Controller", "Customer", "you") that has subscribed to the Service, acting as the data controller for personal data processed through the Service.

This DPA forms part of, and is incorporated by reference into, the Terms of Service between the parties.

Article 1 — Definitions

• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• "Personal Data", "Controller", "Processor", "Data Subject", "Subprocessor", "Supervisory Authority", and "Personal Data Breach" have the meanings given in the GDPR.
• "Service" means the BaciScout tender discovery platform as described in the Terms of Service.

Article 2 — Subject Matter and Duration

This DPA governs the processing of Personal Data by the Processor on behalf of the Controller in connection with the Service. It remains in effect for the duration of the Controller's subscription to the Service and until all Personal Data has been deleted or returned in accordance with Article 7.

Article 3 — Processing Instructions (Art. 28(3)(a))

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organization, unless required to do so by EU or member state law. The Controller's use of the Service constitutes such instructions.

The scope, nature, and purpose of the processing are described in the Privacy Policy and the Controller's configuration of the Service (search profiles, team members, billing data).

Article 4 — Security Measures (Art. 28(3)(b))

The Processor implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption: TLS 1.2+ for data in transit; AES-256 / Fernet for LLM API keys at rest.
• Authentication: Mandatory 2FA (TOTP), django-axes brute-force protection, secure session management.
• Access Control: Role-based access control (RBAC) with object-level permissions; principle of least privilege.
• Network Security: HSTS, CSP, X-Frame-Options, SECURE_SSL_REDIRECT, tenant isolation via PostgreSQL schemas.
• Logging & Monitoring: Structured audit logging with trace IDs; Sentry error tracking with PII sanitization; Prometheus metrics.
• Backup & Recovery: Daily encrypted database backups with tested restore procedures.
• Password Hashing: Argon2id with OWASP-compliant parameters (64 MiB memory cost).

Article 5 — Data Subject Rights Assistance (Art. 28(3)(c)–(e))

The Processor shall assist the Controller, taking into account the nature of the processing, with:

• Fulfilling data subject access requests (DSAR) — provided via data export.
• Right to erasure ("right to be forgotten") — provided via account deletion with 30-day grace period.
• Responding to other data subject requests (rectification, objection, portability).
• Security breach notifications and related communication.

Article 6 — Subprocessors (Art. 28(3)(f))

The Controller grants general authorization for the Processor to engage subprocessors as listed in the Subprocessor List. The Processor shall:

• Carry out due diligence on each subprocessor to ensure they can meet GDPR obligations.
• Enter into a written agreement with each subprocessor imposing data protection terms no less protective than this DPA.
• Provide at least 30 days' notice of any addition or replacement of a subprocessor.
• Allow the Controller to object to a subprocessor change, in which case the Controller may terminate the subscription.

Article 7 — Data Deletion or Return (Art. 28(3)(g))

Upon termination of the Service, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, and delete existing copies, unless EU or member state law requires storage of the Personal Data. A 30-day grace period is provided after subscription expiry for the Controller to export data.

Article 8 — Audit Rights (Art. 28(3)(h))

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to:

• Reasonable advance notice (at least 14 days).
• Confidentiality obligations for the auditor.
• Conduct during normal business hours and without disruption to the Service.

Article 9 — Personal Data Breach Notification

The Processor shall notify the Controller without undue delay (and in any case within 72 hours) after becoming aware of a Personal Data Breach, providing:

• Description of the nature of the breach including categories and approximate number of data subjects and records concerned.
• Name and contact details of the data protection officer or other contact point.
• Likely consequences of the breach.
• Measures taken or proposed to address the breach and mitigate its possible adverse effects.

Article 10 — International Data Transfers

The Processor may transfer Personal Data to a third country (outside the EU/EEA) only with appropriate safeguards in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, Binding Corporate Rules, or an applicable adequacy decision. A list of subprocessors and their locations is published in the Subprocessor List.